ANDROIDOS_ROOTER.B

October 09, 2012
 Analysis by: Karl Dominguez
 THREAT SUBTYPE:

Malicious Downloader

 PLATFORM:

Android OS

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

This malware is installed as com.android.providers.downloadsmanager.

It silently executes when the affected device is booted or when it receives or makes a call. It then gathers certain information on the affected device.

This malware has the capability to download and install other package when commanded by its remote server.

This Trojan arrives as a component bundled with malware/grayware packages.

It requires its main component to successfully perform its intended routine.

  TECHNICAL DETAILS

File Size:

24,028 bytes

Memory Resident:

No

Initial Samples Received Date:

03 Jul 2011

Payload:

Steals information

Arrival Details

This Trojan arrives as a component bundled with malware/grayware packages.

This malware arrives via the following means:

  • Trojanized Android applications

Other Details

This Trojan requires its main component to successfully perform its intended routine.

NOTES:

This malware is installed as com.android.providers.downloadsmanager.

It silently executes when the affected device is booted or when it receives or makes a call. It then gathers the following information:

  • Country
  • IMEI
  • IMSI
  • Installed applications
  • Language
  • Model
  • ProductID
  • SDK version

This malware has the capability to download and install other package when commanded by its remote server.